access_token is inside 'data' dict

Fixes #40.